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DETAILED ACTION 

1 . This office action is in response to the amendment filed June 30, 2006. 

2. Claim 22 is canceled. 

3. Claims 1-21 and 23-26 are pending in this office action. 

Response to Amendment 

4. Applicant's arguments filed June 30, 2006, have been fully considered but 
they are not persuasive. See Response to Arguments. Accordingly, the grounds 
of rejection as presented in the 04/14/06 Office Action, are respectfully 
maintained. 

Claim Rejections - 35 USC § 103 

5. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for 
all obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described 
as set forth in section 1 02 of this title, if the differences between the subject nnatter sought to 
be patented and the prior art are such that the subject matter as a whole would have been 
obvious at the time the invention was made to a person having ordinary skill in the art to which 
said subject matter pertains. Patentability shall not be negatived by the manner in which the 
invention was made. 

6. Claims 1-21 and 23, 25 and 26 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over U.S. Patent 6,185,613 by Lawson et al. (Lawson) in 
view of U.S. Patent 5,903,893 by Kleewein et al. (Kleewein). 

7. With respect to Claim 1 , Lawson teaches a method for providing an 
improved network monitoring system, the network monitoring system comprising 



an event database for storing event data representing events occurring on the 
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network, the event data being gathered by a plurality of monitoring devices 
located at a plurality of different, remote locations on the network, the method 
comprising: 

allowing users to insert one or more triggers into the event database (Col. 
19 line 53 - Col. 20 line 2 and Col. 20 line 36 - Col. 19), the triggers automatically 
initiating a programmed response at the detection of a condition including 
gathered event data prior to insertion of the gathered event data into the event 
database (Col. 6 lines 7-23 and Col. 28 line 40 - Col. 29 line 29); 

distributing the event database to a plurality of remote network locations 
(Col. 8 lines 14-58 and Col. 10 lines 7-23), wherein each remote network location 
stores a local table containing event data generated at the remote location (Col. 
8 lines 36-58) and one or more replica tables containing event data generated at 
other remote locations (Col. 10 lines 7-23 and Col. 15 lines 14-32), and 

using triggers and local and replica tables during delivery of event data to 
users of the network monitoring system (Col. 6 lines 7-23 and Col. 28 line 40 - 
Col. 29 line 29) wherein the local and replica tables update one another when the 
event data of one of said tables changes (Col. 10 lines 7-23, Col. 14 lines 29-28 
and Col. 15 lines 14-32). Lawson further suggests that global information and 
local information could be stored in a common file or in some other format that 
achieves the essential functionality of the invention (Col. 8 lines 59-67). 

However, Lawson does not explicitly disclose a union of the local and 
replica tables (cache of the global registry at each remote location) is generated 
to form a combined event database at the remote location. Kleewein teaches the 
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union of a local and remote table to form a combined database (Col. 3 lines 7-23 
and Col. 1 line 45 - Col. 2 line 23). The union of databases provides for 
transparent access to the data stored in both tables (Col. 1 lines 45-56). 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to take the method disclosed by Lawson and modify it as 
indicated by Kleewein such that the method further comprises wherein a union of 
the local and replica tables is generated to form a combined event database at 
the remote location and using triggers and local and replica table unions during 
delivery of event data to users of the network monitoring system. One would be 
motivated to have this, as there is desire for enabling transparent access to data 
stored in multiple databases (In Kleewein: Col. 1 lines 45-56). 

8. With respect to Claim 2, Lawson further teaches providing a notification 
component for registering similar client requests for event data and substantially 
contemporaneously delivering requested event data to all clients having similar 
registered requests (In Lawson: Col. 6 lines 7-23 and Col. 28 line 40 - Col. 29 
line 29). 

9. With respect to Claim 3, Lawson teaches an event database for use in a 
network monitoring system, the event database storing event data representing 
events occurring on the network, the event data being gathered by a plurality of 
monitor devices located at a plurality of different, remote locations on the 
network, the event database comprising: 

an automation engine for processing one or more triggers contained in the 
event database (Col. 19 line 53 - Col. 20 line 2 and Col. 20 line 36 - Col. 19), the 
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triggers automatically initiating a programmed response at the detection of a 
condition including on gathered event data prior to insertion of the gathered event 
data into the event database (Col. 6 lines 7-23 and Col. 28 line 40 - Col. 29 line 
29); 

a local table stored at each remote network location containing event data 
generated at the remote location (Col. 8 lines 36-58); and 

one or more replica tables stored at each remote network location 
containing event data generated at other remote locations (Col. 10 lines 7-23 and 
Col. 15 lines 14-32), and wherein the local and replica tables update one another 
when the event data of one of said tables changes (Col. 10 lines 7-23, Col. 14 
lines 29-28 and Col. 15 lines 14-32). Lawson further suggests that global 
information and local information could be stored in a common file or in some 
other format that achieves the essential functionality of the invention (Col. 8 lines 
59-67). 

However, Lawson does not explicitly disclose a union of the local and 
replica tables (cache of the global registry at each remote location) is generated 
to form a combined event database at the remote location. Kleewein teaches the 
union of a local and remote table to form a combined database (Col. 3 lines 7-23 
and Col. 1 line 45 - Col. 2 line 23). The union of databases provides for 
transparent access to the data stored in both tables (Col. 1 lines 45-56). 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to take the event database disclosed by Lawson and modify 
it as indicated by Kleewein such that the event database further comprises 
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wherein a union of the local and replica tables is generated to form a combined 
event database at the remote location. One would be motivated to have this, as 
there is desire for enabling transparent access to data stored in multiple 
databases (In Kleewein: Col. 1 lines 45-56). 

10. With respect to Claim 4, Lawson teaches a method for handling event 
data from monitored sites in a computer network, comprising: 

receiving event data from the sites at a monitoring location (Col. 6 lines 7- 
23 and Col. 28 line 40 - Col. 29 line 29); 

when received at the monitoring location, pre-processing the event data 
before the event data is inserted into an event database to determine if a 
condition is met as set forth in a trigger (Col. 6 lines 7-23 and Col. 28 line 40 - 
Col. 29 line 29); and 

if the trigger condition is met, initiating an action relating to the event data, 
the action being defined in the trigger (Col. 6 lines 7-23 and Col. 28 line 40 - Col. 
29 line 29); 

inserting the event data into the event database thereby producing central 
data (Col. 8 lines 14-35 and Col. 28 line 40 - Col. 29 line 29); and 

transmitting the central data to each of the monitored sites (Col. 10 lines 
7-23 and Col. 15 lines 14-32): 

wherein each of the monitored sites includes locally-generated event data 
(Col. 8 lines 36-58) and a replica of the central data (Col. 10 lines 7-23 and Col. 
15 lines 14-32); and 
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wherein the monitored sites update one another when the event data of 
one of said monitored sites changes (Col.. 10 lines 7-23, Col. 14 lines 29-28 and 
Col. 15 lines 14-32). Lawson further suggests that global information and local 
information could be stored in a common file or in some other format that 
achieves the essential functionality of the invention (Col. 8 lines 59-67). 

However, Lawson does not explicitly disclose a union of the locally- 
generated event data and the central data is formed at each of the monitored 
sites. Kleewein teaches the union of a local and remote table to form a 
combined database (Col. 3 lines 7-23 and Col. 1 line 45 - Col. 2 line 23). The 
union of databases provides for transparent access to the data stored in both 
tables (Col. 1 lines 45-56). 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to take the method disclosed by Lawson and modify it as 
indicated by Kleewein such that the method further comprises wherein a union of 
the locally-generated event data and the central data is formed at each of the 
monitored sites. One would be motivated to have this, as there is desire for 
enabling transparent access to data stored in multiple databases (In Kleewein: 
Col. 1 lines 45-56). 

1 1 . With respect to Claim 5, Lawson further teaches wherein pre-processing 
the event data comprises determining whether the event data comprises a 
duplication of other event data in the event database or received at the 
monitoring location (ln Lawson: Col. 17 lines 6-21). 
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12. With respect to Claim 6, Lawson further teaches initiating the action 
comprises denying storage of the event data in the event database if it comprises 
a duplication of other event data (In Lawson: Col. 19 lines 22-42). 

1 3. With respect to Claim 7, Lawson further teaches wherein if the event data 
does not meet the condition, it is temporarily stored outside the data source (In 
Lawson: CoL 21 lines 8-18, Col. 23 line 60 - Col. 24 line 6 and Col. 26 lines 25- 
35). 

14. With respect to Claim 8, Lawson further teaches wherein for even data 
received at the monitoring location, a query is executed, and a condition is 
evaluated, which, if true, causes the execution of the action (In Lawson: Col. 23 
line 60 - Col. 24 line 6 and CoL 24 lines 20-41). 

15. With respect to Claim 9, Lawson further teaches wherein the action 
comprises at least one of a sequence of Structured Query Lanaguage (SQL) 
statements and an external script (In Lawson: Col. 6 lines 7-23 and Col. 28 line 
40 - Col. 29 line 29) 

16. With respect to Claim 10, Lawson further teaches wherein the trigger has 
a coupling mode that indicates when the action should be executed (In Lawson: 
Col. 24 lines 20-41 and CoL 26 lines 17-24). 

17. With respect to Claim 1 1 , Lawson further teaches wherein the trigger 
allows an administrator of the network to connect events, conditions and actions 
(In Lawson: CoL 10 lines 24-56). 

18. With respect to Claim 12, Lawson i further teaches wherein the event data 
comprises a primitive event (In Lawson: CoL 11 lines 9-26). 
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19. With respect to Claim 13, Lawson further teaches wherein the event data 
comprises a database event (In Lawson: Col. 11 lines 9-26). 

20. With respect to Claim 14, Lawson further teaches wherein the event data 
comprises a temporal event (In Lawson: Col. 1 1 lines 9-26). 

21 . With respect to Claim 15, Lawson further teaches wherein the trigger 
comprises a database trigger (In Lawson: Col. 6 lines 7-23 and Col. 28 line 40 - 
Col. 29 line 29). 

22. With respect to Claim 16, Lawson further teaches wherein the trigger 
comprises a temporal trigger (In Lawson: pol, 6 lines 7-23 and Col. 28 line 40 - 
Col. 29 line 29). 

23. With respect to Claim 1 7, Lawson further teaches wherein the temporal 
trigger signals an event at a determined frequency from a specified start time 
until a specified end time (In Lawson: Col. 6 lines 7-23, Col. 24 lines 20-41 and 
Col. 26 lines 17-24, also see claim 8 ). 

24. With respect to Claim 18, Lawson further teaches wherein initiating an 
action comprises communicating a message in accordance with the event data to 
at least one customer location that has subscribed to receive the event data, and 
storing the event data in a data store at the monitoring location (In Lawson: Col. 
28 line 40 - CoL 29 line 29 and Col. 10 lines 7-23). 

25. With respect to Claim 19, Lawson further teaches wherein the pre- 
processing occurs, at least in part, during a period when the data store is 
inaccessible (In Lawson: CoL 10 lines 57-67). 
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26. With respect to Claim 20, Lawson further teaches wherein the message 
communicated in accordance with the event data is included in the union of at 
least event data of a local network and event data of a remote network (In 
Lawson: Col. 8 lines 14-58 and Col. 10 lines 7-23) 

27. With respect to Claim 21 , Lawson further teaches wherein the union 
comprises a union of event data tables (In Lawson: Col. 8 lines 14-58 and Col. 
10 lines 7-23) 

28. With respect to Claim 23, Lawson further teaches wherein the monitoring 
locations update one another with their event data (In Lawson: Col. 10 line 7-23 
and Col. 28 line 40 - Col. 29 line 29). 

29. With respect to Claim 25, Lawson teaches a system for handling event 
data from monitoring sites in a computer network, comprising: 

means for receiving event data from the sites at a monitoring location (Col. 
6 lines 7-23 and Col. 28 line 40 - Col. 29 line 29); 

means for pre-processing the event data, when received at the monitoring 
location, to determine if a condition is met for setting a trigger (Col. 6 lines 7-23 
and Col. 28 line 40 - Col. 29 line 29); 

means for communicating a message, if the trigger is set, in accordance 
with the event data to at least one customer location that has subscribed to 
receive the event data and storing the event data in a data store at the 
monitoring location(CoL 6 lines 7-23 and Col. 28 line 40 - Col, 29 line 29); 
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means for inserting the event data into the event database thereby 
producing central data (Col. 8 lines 14-35 and Col. 28 line 40 - Col. 29 line 29); 
and 

means for transmitting the central data to each of the monitored sites 
(Col. 10 lines 7-23 and Col. 15 lines 14-32): 

wherein each of the monitored sites includes locally-generated event data 
(Col. 8 lines 36-58) and a replica of the central data (Col. 10 lines 7-23 and Col. 
15 lines 14-32); and 

wherein the monitored sites update one another when the event data of 
one of said monitored sites changes (Col. 10 lines 7-23, Col. 14 lines 29-28 and 
Col. 15 lines 14-32). Lawson further suggests that global information and local 
information could be stored in a common file or in some other format that 
achieves the essential functionality of the invention (Col. 8 lines 59-67). 

However, Lawson does not explicitly disclose a union of the locally- 
generated event data and the central data is formed at each of the monitored 
sites. Kleewein teaches the union of a local and remote table to form a 
combined database (Col. 3 lines 7-23 and Col. 1 line 45 - Col. 2 line 23). The 
union of databases provides for transparent access to the data stored in both 
tables (Col. 1 lines 45-56). 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to take the system disclosed by Lawson and modify it as 
indicated by Kleewein such that the system further comprises wherein a union of 
the locally-generated event data and the central data is formed at each of the 
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monitored sites. One would be motivated to have this, as there is desire for 
enabling transparent access to data stored in multiple databases (In Kleewein: 
Col. 1 lines 45-56). 

30. With respect to Claim 26, Lawson teaches an event database for use in a 
network monitoring system, the event database storing event data representing 
events occurring on the network, the event data being gathered by a plurality of 
monitor devices located at a plurality of different, remote locations on the 
network, the event database comprising: 

a local table stored at each remote network location containing event data 
generated at the remote location (Col. 8 lines 36-58); 

one or more replica tables stored at each remote network location 
containing event data generated at other remote locations (Col. 10 lines 7-23 and 
Col. 15 lines 14-32); and 

means for updating the local and replica tables when the event data of 
one of said tables changes (Col. 10 lines 7-23, Col. 14 lines 29-28 and Col. 15 
lines 14-32). Lawson further suggests that global information and local 
information could be stored in a common file or in some other format that 
achieves the essential functionality of the invention (Col. 8 lines 59-67). 

However, Lawson does not explicitly disclose a union of the local and 
replica tables (cache of the global registry at each remote location) is generated 
to form a combined event database at the remote location. Kleewein teaches the 
union of a local and remote table to form a combined database (Col. 3 lines 7-23 
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and Col. 1 line 45 - Col. 2 line 23). The union of databases provides for 
transparent access to the data stored in both tables (Col. 1 lines 45-56). 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to take the event database disclosed by Lawson and modify 
it as indicated by Kleewein such that the event database further comprises 
means for generating a union of the local and replica tables to form a combined 
event database at the remote location. One would be motivated to have this, as 
there is desire for enabling transparent access to data stored in multiple 
databases (In Kleewein: Col. 1 lines 45-56). 



31. Claim 24 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Lawson in view of Kleewein as applied to claim 4 above, and further in view of 
U.S. Patent 6,341,340 by Tsukerman et al. (Tsukerman). 

32. With respect to Claim 24, Lawson in view of Kleewein teaches all the 
limitations of Claim 4 but does not explicitly disclose at least one monitoring 
location is enabled to take ownership of a replica of remotely-generated event 
data to make modification thereto without instructions from the remote monitoring 
location associated therewith. 

Tsukerman teaches the use of ownership in the case where a database 
may be shared between multiple locations (Col. 6 lines 13-33 and Col. 7 line 37 - 
Col. 8 line 22). When a location is given ownership of a database (Col. 7 lines 
15-28 and Col. 8 lines 50-62), the location can make modifications to the 
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database without instructions from any other associated location (Col. 8 lines 4- 
22). This allows for better performance in database operations (Col. 2 lines 6-14 
and 45-56). 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to take the method disclosed by Lawson in view of 
Kleeweing and modify it as indicated by Tsukerman such that the method further 
comprises wherein at least one monitoring location is enabled to take ownership 
of a replica of remotely-generated event data to make modification thereto 
without instructions from the remote monitoring location associated therewith. 
On would be motivated to have this, as it is desirable to have performance 
advantages (In Tsukerman: Col. 2 lines 6-14 and 45-56). 



Response to Arguments 

33. Applicant's arguments filed June 30, 2006 have been fully considered but 
they are not persuasive. 

34. Applicant argues - ''Lawson does not teach or suggest that its registries 
can store the actual "even data generated at [any] location" as recited in claim 

a. Examiner's response - The claim language states "for storing event 
data representing events occurring on the network " (emphasis added). 
Based on the claim language, it is clear that the event data is only 
representative of the events. While list of events present in Lawson might 
not be the actual event data, the examiner asserts that the event data 
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present in the event registries of Lawson is still representative of events 
occurring on the network, otherwise a correlation could not be made 
between the actual event and the event consumer to be notified. 
Additionally, the different locations can generate the list entries in the 
event registries of Lawson (Lawson at Col. 19 lines 47-60). 



Conclusion 

35. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of 
time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire 
THREE MONTHS from the mailing date of this action. In the event a first reply is 
filed within TWO MONTHS of the mailing date of this final action and the advisory 
action is not mailed until after the end of the THREE-MONTH shortened statutory 
period, then the shortened statutory period will expire on the date the advisory 
action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be 
calculated from the mailing date of the advisory action. In no event, however, will 
the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 

Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to David Lazaro whose telephone number is 
571-272-3986. The examiner can normally be reached on 8:30-5:00 M-F. 
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If attempts to reach the examiner by telephone are unsuccessful, the 



examiner's supervisor, Saleh Najjar can be reached on 571-272-4006. The fax 



phone number for the organization where this application or proceeding is 
assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from 
the Patent Application Information Retrieval (PAIR) system. Status information 
for published applications may be obtained from either Private PAIR or Public 
PAIR. Status information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, see http://pair- 
direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll- 
free). If you would like assistance from a USPTO Customer Service 
Representative or access to the automated information system, call 800-786- 
9199 (IN USA OR CANADA) or 571-272-1000. 




David lazaro 
September 1 1 , 2006 
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